News for hackers. Stuff that matters.

A comment on CVE-2014-7169: Bash Fix Incomplete, Still Exploitable. Parent comment

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by odc on Thursday September 25, 2014 @04:00AM (#8366118)
Yes, this exploit can be used on any script or program that uses system(), whatever language you use.

Using bash as the default /bin/sh is the real bug here.

[ Parent | on HN ]
Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by dllthomas on Thursday September 25, 2014 @10:34AM (#8367361)
"Yes, this exploit can be used on any script or program that uses system(), whatever language you use."

Unless that script or program sanitizes the environment before calling system(). In practice that might not presently be any scripts or programs, but it principle it's a tiny bit weaker than you say.

[ Parent | on HN ]